[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

Re: [tor-bugs] #13670 [Tor Browser]: ensure OCSP & favicons respect URL bar domain isolation

#13670: ensure OCSP & favicons respect URL bar domain isolation
---------------------------------+---------------------------------------
     Reporter:  arthuredelstein  |      Owner:  arthuredelstein
         Type:  defect           |     Status:  needs_revision
     Priority:  normal           |  Milestone:
    Component:  Tor Browser      |    Version:
   Resolution:                   |   Keywords:  tbb-linkability, ff38-esr
Actual Points:                   |  Parent ID:
       Points:                   |
---------------------------------+---------------------------------------

Comment (by arthuredelstein):

 Replying to [comment:28 mikeperry]:
 > The favicon portion of this patch checks and sets an nsINode attribute
 that specifies the first party. I believe this can be abused by content to
 set its own attributes to circumvent our domain isolation.

 This is a good observation that I had missed. One alternative might be to
 add a SetIsolationKey method to nsINodes, that would only be accessible to
 C++ and chrome javascript.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/13670#comment:29>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs